Research from Accenture revealed interruptions to the power supply from cyber attacks is the most serious concern
Two-thirds (63 per cent) of utility executives reckon their country faces at least a “moderate risk” of electricity supply interruption from a cyber attack on electric distribution grids within the next five years, a new study finds.
This figure rises to 76 per cent for North American utilities executives.
The survey of more than 100 utilities executives from over 20 countries revealed interruptions to the power supply from cyber attacks is the most serious concern, cited by 57 per cent of respondents. Just as worrying is the physical threat to the distribution grid.
More than half (53 per cent) of executives cite employee and/or customer safety and 43 per cent of executives cite the destruction of physical assets as their biggest concerns.
As a consequence, Accenture’s report, Outsourcing Grid Security Threats, part of the Digitally Enabled Grid research programme, warns that “unprepared” distribution utilities must act now to improve their cyber security capabilities.
While the increased connectivity of industrial control systems enabled by the smart grid will drive significant benefits in the form of safety, productivity, improved quality of service and operational efficiency, 88 per cent of respondents agreed that cyber security is a major concern in smart grid deployment.
Distribution utilities are also increasingly exposed by the growth of connected Internet of Things (IoT) domestic devices, such as connected home hubs and smart appliances. These bring a new risk to distribution companies, which is hard to quantify, with four fifths (77 per cent) of utilities executives suggesting IoT as a potential threat to cyber security.
“As highly sophisticated, weaponised malware is being developed, a greater risk to distribution businesses arises from cyber criminals and others who would use it for malicious purposes,” said Stephanie Jamison, managing director, Accenture transmission and distribution.
“Attacks on industrial control systems could disrupt grid reliability and the safety and wellbeing of employees and the public. Not getting it right could be a brand killer, as well as a real threat for a country and the community.”
In Asia Pacific and Europe, cyber criminals are seen as the biggest risk for distribution businesses by almost a third of respondents. However, in North America, attacks by governments are considered a bigger risk than in regions worldwide (32 per cent).
“Deployment of the smart grid could open new attack vectors if cyber security is not a core component of the design,” added Jamison. “However, the smart grid can also bring sophisticated protection to assets that were previously vulnerable through improved situational awareness and control of the grid.”
A significant number of distribution utilities have much to do in developing a robust cyber response capability with more than two-fifths of respondents claiming cyber security risks were not, or were only partially integrated, into their broader risk management processes.
In addition, the increasing convergence of physical and cyber threats requires the development of capabilities that go well beyond simple security-related national compliance requirements. Utilities must invest in resilience of their smart grid as well as effective response and recovery capabilities, the report states.
Proper protection is challenging due to the complexity of distribution electric grids and increasingly sophisticated, well-funded attackers, and many distribution utilities are still under-protected and under-prepared. Only 6 per cent felt extremely well-prepared and half (48 per cent) well-prepared, when it came to restoring normal grid operations following a cyber attack.
While there is no single path forward, there are some moves any distribution business should consider to strengthen resilience and response to cyber attack, such as:
“Cyber security must become a core competency in the industry by protecting the entire value chain and the extended ecosystem end-to-end. Utilities, already well-versed in reliable power delivery and power restoration, need an agile and swift capability that creates and leverages situational awareness, and that can quickly react and intervene to protect the grid,” said Jim Guinn, managing director who leads Accenture’s security practice for resources industries.
“Developing this new capability will require ongoing innovation, a practical approach to scaling, and collaboration with partners to drive the most value.”
If you like this, you might be interested in reading the following:
Atos and Siemens team up to boost industrial cyber defences
Companies will collaborate in the area of cyber-security for the utilities, oil and gas industries in the US
Opportunities and threats
The boss of one of the UK’s leading data security firms welcomes faster connectivity but warns that it can also mean the ‘surface area’ for attacks is greater
UK government unveils national cyber security plan
Chancellor Philip Hammond sets out a £1.9bn security strategy that aims to strike back at malicious hackers